Threat of the Week: ATM Traps on the Comeback Trail

The number is jaw dropping. ATM fraud, mainly ATM traps, is up 16 fold year-on-year in Ireland, according to the Irish Payments Services Organization.

In France, a well-organized gang – armed with forks – has stolen a million Euros, simply by jamming cash dispensers on ATMs.

ATM traps, once fairly common in the US, had fallen sharply out of favor in recent years as crooks focused on skimming. The bad news: ATM traps, aimed at cash or cards or both, may well be heading back to the U.S., warn multiple experts.

In fact they already are here, said Owen Wild, an executive with ATM maker NCR: “We are seeing trapping in North America.”

He added, “Trapping has become a major concern and annoyance for our customers.”

The trigger in Europe has been the switch to chip-and-PIN credit and debit cards – essentially killing off magnetic stripe skimming. In the US many institutions are marching towards an implementation of chip-and-PIN (aka EMV) and with that will likely come a spurt in traps.

What a trap does is what the name implies. If it’s in the cash slot, it physically prevents the currency from exiting the ATM. If it is the card slot, it does likewise. A plus of traps for crooks: they generally are crude, easy to fabricate. Security blogger Brian Krebs has multiple images of traps here and the takeaway is that just about any bent criminal can make them.

Even better for a crook is that with traps, the payoff is instant. The criminal waits for frustrated ATM customers to angrily stalk off without their money, then calmly approaches the ATM and pulls out the trapped cash.

If a card was trapped, the criminal usually has used a camera to capture the PIN – and then with the retrieved card, he makes a new withdrawal, immediately putting money in his pocket.

Traps also are getting slicker, easier for criminals to deploy. “We are seeing more sophisticated traps,” said Jim Pettit, an executive with ATM maker Diebold. “There’s been an advancement in the design.”

Brent Woodside, another Diebold executive, added, “Card trapping has shown an increase on Europe – it’s up 75% between 2011 and 2012. Improvements in anti-skimming solutions is leading to this”

A problem with traps from the criminal’s perspective is that they are labor intensive. “You return to the ATM usually after every trap,” said Woodside.

That of course ups the chances of detection and arrest.

From the financial institution’s perspective, a real issue with traps is the damage they commonly do to ATMs, said Darren Hayes, a forensics expert at Pace University in New York. Remember, this is hardware that is forcibly jammed into delicate machinery and, suggested Hayes, sometimes the costs to repair the ATM is far greater than the amount of hard cash lost to trappers.

A note of good news for financial institutions comes from NCR’s Wild, who said, “You will likely find that trapping is more prevalent where there are older models. We have gotten better in protecting cash dispensers on newer models.”

Newer ATMs just are smarter when it comes to detecting, and thwarting, foreign objects in the cash or card slots. Some will detect a foreign object and simply take themselves out of service, which means that particular ATM trapper is out of luck.

But owners of older ATMs are not necessarily left without options. Said Wild: “We have provided upgrade kits for older ATMs to gain enhanced protection.”

Good policy just might be – as the countdown to EMV gets louder – to contact the ATM maker and ask what upgrades are available. A sharp jump in traps seems inevitable but ATM makers already are in the hunt for still better technologies to frustrate trappers, and this is a threat that just maybe financial institutions will be able to keep in front of.